Local reference
Suspicious dependency
Inferred
Mal-ecule
K(Te)H(F)Md(Pa₃)
Referenced by 10 samples
- benign ed_privacy_protect-1.0.1.xpi fetched
- benign github.com-comfy-org-comfyui_frontend-v1.22.0-sub.7.zip fetched
- suspicious Eugeny-tabby-v1.0.233-tabby-1.0.233-macos-x86_64.zip fetched
- benign github.com-Cloud-copilot-Iam-collect-v0.1.21.zip fetched
- benign github.com-microsoft-teams-ai-v0.0.0-20260720223352-2d3ffbd1d6cf.zip fetched
- benign github.com-cloud-copilot-iam-utils-v0.1.79.zip fetched
- hostile ruvnet-ruflo.tar.gz fetched
- benign 7152eba30c6575329ac0576536151aca5a72780e fetched
- suspicious github.com-origintrail-dkg-v9-v10.0.13+incompatible.zip fetched
- benign github.com-JaNDeDoBbEleEr-oh-my-posh-v24.9.1+incompatible.zip fetched
Well-known
notable severity, 98% confident.
tool/development
Official pnpm env-replace package name
Micro-behaviors
notable severity, 80% confident.
fs/path
Hardcoded absolute home directory path
Metadata
notable severity, 95% confident.
package/files
JavaScript file under dist directory
notable severity, 90% confident.
package/manifest
Repository identifies major Git host
notable severity, 96% confident.
package/testing/harness
Calls a test-case function
baseline severity, 90% confident.
build
Code has source map reference
baseline severity, 80% confident.
file/profile
English function-word token "the"
baseline severity, 99% confident.
lang
TypeScript declaration file
baseline severity, 95% confident.
library
Contains bundled or minified JavaScript
baseline severity, 100% confident.
package
package.json defines a package version
baseline severity, 95% confident.
package/dependencies
npm manifest has empty dependencies object
baseline severity, 100% confident.
package/quality
package.json defines a package name
component severity, 100% confident.
file/extension
File uses a source declaration extension
component severity, 85% confident.
package/testing/presence
File is a test or type-declaration source file
Identity
| SHA-256 | dbbdd6a3f165051d3aa97cfcaab6e539a57f21adc0f911197f39a50cd17a8998 |
|---|---|
| Canonical SHA-256 | 182f5b154763a4274f0990e4cc3e499b4fad6da7e09ef6cf9bdf4a3e78e4665f |
| Filename | [email protected] |
| Package | @pnpm/config.env-replace |
| Version | 1.1.0 |
| PURL | pkg:npm/@pnpm/[email protected] |
Origin
| Source | x |
|---|---|
| Feed | pkg.go.dev |
| Ecosystem | javascript |
| Domain | npmjs.org |
| URL | https://registry.npmjs.org/@pnpm/config.env-replace/-/config.env-replace-1.1.0.tgz |
Timeline
| First seen | 1 Aug 2026 18:47 UTC |
|---|---|
| First analyzed | 1 Aug 2026 18:48 UTC |
| Last analyzed | 26 Aug 2026 20:33 UTC |
| Last updated | 26 Aug 2026 20:33 UTC |
Labeling
| Label | unknown |
|---|---|
| Traits version | 72034 |
Not seeing what you expected? Let us know